@ragable/sdk 0.5.0 → 0.5.1

package/dist/index.mjs

@@ -9,6 +9,7 @@ function bindFetch(custom) {
     return f.call(globalThis, input, init);
   };
 }
+var DEFAULT_RAGABLE_API_BASE = "https://ragable-341305259977.asia-southeast1.run.app/api";
 var RagableError = class extends Error {
   constructor(message, status, body) {
     super(message);
@@ -40,7 +41,7 @@ var RagableRequestClient = class {
     __publicField(this, "fetchImpl");
     __publicField(this, "defaultHeaders");
     this.apiKey = options.apiKey;
-    this.baseUrl = options.baseUrl ?? "http://localhost:8080/api";
+    this.baseUrl = options.baseUrl ?? DEFAULT_RAGABLE_API_BASE;
     this.fetchImpl = bindFetch(options.fetch);
     this.defaultHeaders = options.headers;
   }
@@ -1107,7 +1108,8 @@ var PostgrestTableApi = class {
 
 // src/browser.ts
 function normalizeBrowserApiBase(baseUrl) {
-  return (baseUrl ?? "http://localhost:8080/api").replace(/\/+$/, "");
+  const trimmed = (baseUrl ?? DEFAULT_RAGABLE_API_BASE).trim().replace(/\/+$/, "");
+  return trimmed.endsWith("/api") ? trimmed : `${trimmed}/api`;
 }
 function requireAuthGroupId(options) {
   const id = options.authGroupId?.trim();
@@ -1131,6 +1133,20 @@ async function requireAccessToken(options) {
   }
   return token.trim();
 }
+async function resolveDatabaseAuthBearer(options) {
+  const mode = options.dataAuth ?? "user";
+  if (mode === "user") {
+    return requireAccessToken(options);
+  }
+  const fromGetter = options.getDataStaticKey ? await options.getDataStaticKey() : null;
+  const key = (fromGetter?.trim() || options.dataStaticKey?.trim()) ?? "";
+  if (!key) {
+    throw new Error(
+      mode === "publicAnon" ? "dataAuth publicAnon requires getDataStaticKey or dataStaticKey (rotate key in dashboard)" : "dataAuth admin requires getDataStaticKey or dataStaticKey (server-side only; rotate in dashboard)"
+    );
+  }
+  return key;
+}
 async function parseJsonOrThrow(response) {
   const payload = await parseMaybeJsonBody(response);
   if (!response.ok) {
@@ -1300,7 +1316,7 @@ var RagableBrowserDatabaseClient = class {
   }
   async query(params) {
     const gid = requireAuthGroupId(this.options);
-    const token = await requireAccessToken(this.options);
+    const token = await resolveDatabaseAuthBearer(this.options);
     const databaseInstanceId = params.databaseInstanceId?.trim() || this.options.databaseInstanceId?.trim();
     if (!databaseInstanceId) {
       throw new Error(
@@ -1310,6 +1326,7 @@ var RagableBrowserDatabaseClient = class {
     const headers = this.baseHeaders();
     headers.set("Authorization", `Bearer ${token}`);
     headers.set("Content-Type", "application/json");
+    const readOnly = (this.options.dataAuth ?? "user") === "publicAnon" ? true : params.readOnly !== false;
     const response = await this.fetchImpl(
       this.toUrl(`/auth-groups/${gid}/data/query`),
       {
@@ -1319,7 +1336,7 @@ var RagableBrowserDatabaseClient = class {
           databaseInstanceId,
           sql: params.sql,
           ...params.params !== void 0 ? { params: params.params } : {},
-          ...params.readOnly === false ? { readOnly: false } : {},
+          readOnly,
           ...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
           ...params.rowLimit !== void 0 ? { rowLimit: params.rowLimit } : {}
         })
@@ -1494,6 +1511,7 @@ function createRagableServerClient(options) {
 }
 export {
   AgentsClient,
+  DEFAULT_RAGABLE_API_BASE,
   PostgrestDeleteReturningBuilder,
   PostgrestDeleteRootBuilder,
   PostgrestInsertReturningBuilder,